Filter for a specific time frame in Wireshark.

Posted: October 9, 2015. At: 11:18 AM. This was 2 years ago. Post ID: 8423
Page permalink.
WordPress uses cookies, or tiny pieces of information stored on your computer, to verify who you are. There are cookies for logged in users and for commenters. These cookies expire two weeks after they are set.

To filter for a specific time frame in Wireshark, there is the frame.time filter. Used as in the example below, this will show all packets that have arrived in the time frame of Aug 12, 2015 14:50:10 to Aug 12, 2015 14:51:10. This is useful when drilling down to a specific conversation.

Here is our completed example time frame filter.

(frame.time >= "Aug 12, 2015 14:50:10") && (frame.time <= "Aug 12, 2015 14:51:10")

This is very easy. To get this working, select any packet in the Packet List. Expand the Frame section in the Packet Details pane. Right-click on Arrival Time and select Prepare a Filter > Selected. This will appear in the display filter field:

frame.time == "Oct 15, 2012 16:36:01.009638000"

Edit this display filter. Change the “==” to “>=” and change the time to the earliest time you want your display filter to show. For example:

frame.time >= "Oct 15, 2012 16:00:00"

Now right-click on Arrival Time again and select Prepare a Filter > And Selected. You will now have something like this:

(frame.time >= "Oct 15, 2012 16:00:00") && (frame.time == "Oct 15, 2012 16:36:01.009638000")

Now edit the second part of the filter. Change “==” to “<=" and change the time to the latest time you want your display filter to show. For example:

(frame.time >= "Oct 15, 2012 16:00:00") && (frame.time <= "Oct 15, 2012 17:00:00")

Click Apply. This example display filter will show all frames arriving between 16:00 and 17:00 local time on October 15th.

No comments have been made. Use this form to start the conversation :)

Leave a Reply